2
$\begingroup$

I have set A of passwords created under policy A and set B of passwords created under policy B. Maximum password length in both conditions is 15. The number of passwords in each set is nearly 70.

I found that 50% passwords in set A are of length 8 and no password in set A has length 11 and 13.

While in set B passwords length vary from 8 to 15. The proportion of passwords in set B having length 8 to 15 doesn't seem to vary much.

Clearly the password length created with policy B is relatively unpredictable.

How do I capture this intuition more formally. Is there any statistical measure to do so? I have the password length distribution for set A as well as set B.

Performing Chi square test of independence with null hypothesis "passwords created under policy A and policy B has no effect on the resulting password length" will reject the null hypothesis. Am I right?

Also if the policies has effect on password length, policy B seems to create more secure passwords, since in this case the proportion of passwords belonging to different lengths are somewhat similar. How do I capture this intuition?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
1
$\begingroup$

It sounds like you want to do two things:

  1. Represent the fact that policy B results in longer passwords. For this I would just give the mean of each policy's password length distribution. To show the difference is statistically significant you could use a t-test, provided you have a reasonably large sample set of passwords from both policies.

  2. Quantify the added "unpredictability" that policy B has, given that its password length distribution is flat, while policy A has a spike at length 8 passwords. For this you should calculate the information entropy of each length distribution. The expected result is that B has higher entropy. The difference Entropy(B)-Entropy(A) will quantify the number of "extra bits of information" that a password cracker must guess under policy B, relative to policy A.

Improve this answer
$\endgroup$
3
  • $\begingroup$ why not chi squared or Fischer Exact test to show the statistical significance? $\endgroup$
    – Curious
    Commented Sep 10, 2015 at 11:20
  • $\begingroup$ I have 2 policies and 8 different lengths (from 8 to 15). So can't I treat this as a contingency table of 2X8 (2 policies and 8 different lengths)? $\endgroup$
    – Curious
    Commented Sep 11, 2015 at 3:53
  • $\begingroup$ You can do that, but all it will do is show that the password length distributions under policies A and B are different. The t test and the entropy are more informative about the differences that have security relevance. $\endgroup$
    – Paul
    Commented Sep 11, 2015 at 10:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.